Smarter Everything Powered By Afero

Kathleen Moriarty & Ben Carter of CIS join Smarter Everything to discuss the importance of preventative security measures within the IoT market and best practices for vendors when trying to build security into their products.

Key Takeaways

• The CIS gathers, normalizes, and shares information on threats and vulnerabilities in a structured manner, which empowers organizations to proactively protect themselves against attacks.
• When it comes to building security models, the prescriptive guidance that the CIS provides helps organizations save time and valuable resources.
• Rather than being product-specific, the CIS aims to develop practices that can be scaled and applied over a multitude of markets.

Time Stamps

• 02:33 Defining CIS and what brought Kathleen there
• 07:55 What is an ISAC?
• 11:56 Ben’s job at CIS 
• 13:29 CIS’s motivation for publishing security reports
• 15:58 How Ben got his start in IoT
• 17:40 Biggest challenges in the IoT space
• 24:50 Management scale and sustainability concerns in cybersecurity
• 27:56 Where Kathleen sees the IoT market going in 12 to 24 months
• 29:33 Current influential standards in the industry
• 33:15 Kathleen’s book and what IoT professionals need to pay attention to

Grace Burkard, Director of Operations at ioXt Alliance, is back on Smarter Everything for part two of her conversation with Bret. They discuss the many privacy concerns that have surfaced as new devices have developed, what ioXt is trying to do about, and how world leaders aim to join forces to increase cybersecurity standards.

Key Takeaways

• With the increasing number of IoT devices in our lives, consumers need to be vigilant and demand better security measures for their connected devices.
• Manufacturers should prioritize security, transparency, and privacy from the beginning to mitigate loss and build trust with consumers.
• World leaders are collaborating to achieve a unified approach to standards and certifications, enhancing the security and privacy of IoT devices globally.

Time Stamps

• 01:17 The privacy concerns with IoT devices
• 07:12 Things that smart device consumers should be aware of
• 12:40 How consumers can dictate change in the industry
• 17:14 Harmonizing cybersecurity efforts with other world leaders
• 21:49 Predictions in the IoT space over the next 18 to 24 months
• 26:58 How advancements in technology are exceeding past expectations

Grace Burkard, Director of Operations at ioXt Alliance,  joins Smarter Everything to kick off this two-part conversation to discuss ioXt's mission, the U.S. Cyber Trust Mark program, and the importance of improving the state of IoT security across the industry..

Key Takeaways

• The U.S. Cyber Trust Mark program aims to create a security baseline for IoT devices. It indicates that a device meets basic security requirements, helping consumers make better buying decisions.
• The program includes a binary label for easy recognition, along with a QR code that provides more detailed information about the device's security features.
• These profiles help manufacturers demonstrate their commitment to cybersecurity. Obtaining the mark will differentiate companies from their competitors and will build trust with end users.

Time Stamps

• 02:17 A quick look into ioXt
• 09:49 Defining the U.S. Cyber Trust Mark program and what it means for the market
• 14:02 When will this all take place?
• 16:11 Why industry involvement is crucial when new regulations take place
• 19:43 Will U.S. Cyber Trust Mark testing be mandatory?

Saurabh Shintre, an expert in artificial intelligence, machine learning, and cybersecurity is back on this episode of Smarter Everything to address concerns about using natural language processing tools in the workplace and how security measures must adapt to this changing reality — all while remaining optimistic for the future.

Key Takeaways

• While natural language processing systems like ChatGPT may help boost productivity in the workplace, different types of tooling will be necessary to protect sensitive information from leaking into the model.
• Data that makes it into the model cannot yet be easily removed.  
• Authentication, authorization, and audit processes should be in place for all AI actions.

Time Stamps

• 02:26 How natural language processing models change computing
• 05:53 Security and privacy concerns with large language models
• 13:34 Positive use cases for AI systems
• 17:43 Natural language processors potential in IoT devices
• 20:14 Where Saurabh sees technology going
• 22:02 New opportunities and change in the AI space

In today’s technologically driven world, AI is developing at a rapid pace. As we embrace the opportunity that this creates, it’s important to be aware of how these systems work.

Saurabh Shintre, an expert in artificial intelligence, machine learning, and cybersecurity joins Smarter Everything to discuss generative AI’s potential, natural language processing tools (such as ChatGPT), as well as exploring their current limitations and the challenges of fine-tuning these models. We will also discuss the accuracy of the responses generated, and how this new technology may affect the future of work and education.

Key Takeaways

• Information that becomes part of the training parameters for these models is not easily removed. They act like “black holes” of information, condensing data from all over the internet, and it’s difficult to see what is actually happening on the inside.
• The output of language models is probabilistic, and the models can generate irrelevant or non-existent information. These outputs are referred to as “hallucinations”.
• These systems cannot operate on their own quite yet and still require human oversight.

Time Stamps

• 02:46  Saurabh’s background
• 04:51  What is generative AI, and how is ChatGPT different from earlier ML models?
• 09:44 How ChatGPT learns through human feedback
• 14:28 How the models act like “black holes” of information and the issues this can cause
• 18:49 Thoughts on responses that could be patented or copyrighted information
• 19:55 Large language model temperature values explained
• 21:28 Generative AI and ChatGPT in education

In this episode, Nick shares how customer feedback is essential for modern-day businesses, and how The Home Depot aims to make Smart Home technology easily accessible to any customer.

Listen in to learn what The Home Depot is doing with their Hubspace program.

• How smart home technology is becoming more prevalent and integrated into everyday devices
• How Hubspace has developed a solution to simplify the setup process for smart home devices
• Why ease-of-use and reliability impact smart home technology adoption

Timestamps

• 01:45  Ease of use and customer satisfaction
• 05:50  How The Home Depot is enhancing cybersecurity, customer satisfaction, and cost-effectiveness
• 10:39  Helping others love smart technology 
• 15:42  Customer reviews and improving branding and marketing 
• 19:55  Hubspace plans to expand into more product categories while addressing cybersecurity concerns in the market
• 23:50  If you do right by your customers, it will lead to success

In this episode, Nick discusses the intricacies of building a smart home and the importance of cybersecurity. He also shares how Home Depot is investing in the smart home market and creating products inside their private label brands to simplify their customer's life.

Listen in to learn what The Home Depot is doing with their Hubspace program.

• The importance of simplifying smart home products and streamlining infrastructure
• Why the customer should be at the forefront of all smart device innovation
• Why cybersecurity should be a priority in every home device, even light bulbs

Timestamps

• 03:18  Getting to know Nick 
• 05:55  Simplifying the customer experience by incorporating private brands
• 08:38  More about Hubspace 
• 14:35  Breaking the smart home adoption chasm 
• 16:03  Why we need to simplify smart home products
• 20:40  Having an entrepreneurial spirit and customer focus

For this episode of ‘Smarter Everything’ my guest is Waylon Grange, a seasoned security researcher and engineer with a rich background in cryptography, protocol analysis, and industrial control systems. Waylon has dedicated his career to safeguarding enterprise networks, critical infrastructure, exposing threat actors, and understanding the intricacies of malware.

We will cover a variety of topics from Industrial Control Systems to Cryptography, and the benefits and dangers that come with them. In addition to these topics, Waylon will share more about his past experiences in helping to defend our very way of life.

Key Takeaways

• How Industrial Control Systems evolve, and what effects they have on our daily lives.
• Not all smart devices are secure.
• The danger of smart devices that are connected to important infrastructure.

Time Stamps

• 02:43 What Waylon is working on today
• 03:45 What are industrial control systems (ICS)?
• 05:12 Waylon’s solar panel project
• 12:33 Dangers in cryptography
• 15:55 Who is Cloud Atlas / Inception?
• 22:27 The risks with smart devices connected to critical infrastructure
• 26:08 Waylon’s encounter with a botnet owner
• 30:10 Not all devices are secure
• 31:14 Engagement with law enforcement during a facility pen test
• 38:33 Waylon’s Defcon Black badge
• 40:36 Final thoughts on this upcoming smart and connected world

In Part 2 of our conversation with Kirsty Paine, Strategic Advisor, Technology and Innovation at Splunk, she navigates the treacherous terrain of IoT standards and security, revealing the powerful potential of a hyperconnected world while uncovering the lurking dangers of a fractured standards landscape.

Kirsty joins host Bret Jordan, Chief Security Strategist at Afero, as they talk about:

1. What lies ahead in the future of connectivity

2. How standards bodies enhance the security of IoT devices

Kirsty Paine is former NCSC, and is an expert on IoT, smart and connected homes and international standards, security, and legislation.

Key Takeaways

• There was a real sense of teamwork working on IoT standards at ETSI
• “Attack surface” and the concerns that arise for consumers
• Weak security: “admin-admin” passwords
• Don’t wait to be hacked before you decide to take security seriously
• Uncooperative individuals in standards can leave out important use cases

Time Stamps

• [01:48] Fractured standards
• [04:59] Attack surface
• [08:08] Baby cameras as a security risk
• [10:56] Cyber attacks happen to everyone
• [15:01] Tallying your connected devices
• [16:53] The darker side to standards

We’re seeing a rapid expansion of IoT devices and it’s not slowing down. Understanding the standards landscape will take a long time to develop but it's critical for the security of devices moving forward.

On today’s episode, we’re speaking with one of the most passionate advocates of the new globally applicable standard for IoT security, ETSI EN 303 645.

Kirsty Paine, Strategic Advisor, Technology and Innovation at Splunk, speaks with Smarter Everything host Bret Jordan about navigating IoT labeling in the controversial arena of security standards of connected devices.

Key Takeaways

• The ETSI EN 303 645 standard, the first globally applicable standard for IoT security, and its importance for consumer devices.
• How the EU Cyber Resiliency Act will impact the state of cybersecurity for products with a digital element.
• The debate between the Singaporean and UK approaches to labeling IoT devices to increase security.

Time Stamps

• [04:01] Why IoT standards are fun
• [08:02] ETSI EN 303 645 standards, the first globally applicable standard for IoT security
• [13:14] Why ETSI EN 303 645 is important
• [16:10] How the UK is regulating and incentivizing security
• [19:45] The latest on IoT Labeling

Resources

EN 303 645

TS 103 701

TR 103 621

CLS (Cybersecurity Labeling Scheme)

UK Parliament Bill 3069